<!DOCTYPE html>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<div id="test-container"><script>
var sacrifice;
test(() => {
  let testContainer = document.getElementById('test-container');
  let iframe = document.createElement('iframe');
  testContainer.appendChild(iframe);
  let doc = iframe.contentDocument;
  let script = doc.createElementNS('http://www.w3.org/2000/svg', 'script');
  script.type = 'invalid-type';
  script.textContent = 'document.body.appendChild(parent.sacrifice)';
  sacrifice = document.createElement('div');
  script.appendChild(sacrifice);
  doc.body.appendChild(script);
  script.type = '';
  // adoptNode() calls script.removeNode(sacrifice) internally, and this DOM
  // mutation kicks the script.
  document.adoptNode(sacrifice);
}, 'Reparenting in removeNode() in adoptNode() should not crash.');
</script>
